PT-2021-23140 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions 2.7.8 and earlier Description: Discourse is an open source platform for community discussion. In affected versions, maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation i...

CVE-2021-42332

The “List View” function of ShinHer StudyOnline System is not under authority control. After logging in with user’s privilege, remote attackers can access the content of other users’ message boards by crafting URL parameters...

CVE-2021-42331

The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can access and edit other users’ tutorial schedule by crafting URL parameters...

CVE-2021-40843

Proofpoint Insider Threat Management Server contains an unsafe deserialization vulnerability in the Web Console. An attacker with write access to the local database could cause arbitrary code to execute with SYSTEM privileges on the underlying server when a Web Console user triggers retrieval of...

Sql injection

Proofpoint Insider Threat Management Server contains an unsafe deserialization vulnerability in the Web Console. An attacker with write access to the local database could cause arbitrary code to execute with SYSTEM privileges on the underlying server when a Web Console user triggers retrieval of...

CVE-2021-40843

Proofpoint Insider Threat Management Server contains an unsafe deserialization vulnerability in the Web Console. An attacker with write access to the local database could cause arbitrary code to execute with SYSTEM privileges on the underlying server when a Web Console user triggers retrieval of...

Cross-Site Scripting (XSS)

prestashop/pslinklist is vulnerable to cross-site scripting. The vulnerability exists because the custom URLs are not validated in 'buildForm' function in 'CustomUrlType.php' allowing a malicious attacker to inject arbitrary scripts...

Stored XSS with custom URLs in PrestaShop module ps_linklist

Impact Stored XSS when using custom URLs. Patches The problem is fixed in 3.1.0 References Cross-site Scripting XSS - Stored CWE-79...

Qu1cksc0pe - All-in-One Static Malware Analysis Tool

This tool allows you to statically analyze Windows, Linux, OSX executables and APK files. You can get : What DLL files are used. Functions and APIs. Sections and segments. URLs, IP addresses and emails. Android permissions. File extensions and their names. And so on... Qu1cksc0pe aims to get even...

CVE-2021-1534 Cisco Email Security Appliance URL Filtering Bypass Vulnerability

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker...

CVE-2021-1534 Cisco Email Security Appliance URL Filtering Bypass Vulnerability

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker...

Cisco AsyncOS for Cisco Email Security Appliance 输入验证错误漏洞

The Cisco Email Security Appliance ESA and Cisco AsyncOS are both products of Cisco, Inc.The Cisco Email Security Appliance is an email security appliance.The Cisco AsyncOS is an operating system for Cisco devices. Cisco AsyncOS is an operating system for Cisco devices. An input validation error...

HTTP Host Header Injection

Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C 3.5 Problem It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the frontend...

Input validation

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the...

CVE-2021-41114

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the...

CVE-2021-41114

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the...

HTTP Host Header Injection in Request Handling

It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the frontend rendering process. Since the host header itself is provided by the client, it can b...

UBUNTU-CVE-2021-39900

Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availability via Rails logs...

GitLab 日志信息泄露漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

PT-2021-22747 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 10.8 and later Description: The issue allows for information disclosure from SendEntry in GitLab, exposing the full URL of artifacts stored in object-storage. This exposure occurs via Rails logs and is temporary...